Technical and Organisational Measures (Art. 32 GDPR)

Controller: NLTS Global Analytics s.r.o., Malá 43/6, 301 00 Pilsen, CZ

Last updated: April 2026

1. Physical Access Control

• Server location: EU (DigitalOcean, Frankfurt am Main).
• Physical security is ensured by the data centre operator (ISO 27001, SOC 2 certified).
• NLTS does not operate its own data centre.

2. System Access Control

• Magic link authentication (no passwords stored).
• API key hashing with SHA-256.
• Session management with cryptographically secure tokens.
• Rate limiting on all endpoints.

3. Data Access Control

• Role-based access control (RBAC).
• Strict admin/user separation.
• API keys with tier-based access (permitted scan types, individual rate limits).

4. Data Transfer Control

• TLS 1.3 for all connections.
• HSTS with includeSubDomains and preload.
• Ed25519-signed reports (cryptographic proof of origin).
• Content hash (SHA-256) in every report for integrity verification.
• Cloudflare WAF as additional protection layer.

5. Input Control

• Append-only audit log for all scan operations.
• UTC timestamps in all reports.
• Immutable scan IDs (UUID v4).

6. Processing Control

• Data processing agreement (DPA) pursuant to Art. 28 GDPR — see DPA.
• Documented instruction binding.
• Sub-processor directory — see Sub-processors.

7. Availability Control

• Redis-based job queue with automatic retry mechanism.
• Automatic restart on process failures.
• Daily database backups.
• SLA agreement — see SLA.

8. Data Segregation

• Tenant separation via user IDs.
• Scan data isolated per assignment.
• Separate database tables for different data types.

9. Pseudonymisation

• IP addresses are anonymised after 7 days.
• Scan IDs as UUID (not traceable to natural persons).
• Email addresses stored only as required for delivery.

10. Encryption

• TLS 1.3 — transport encryption for all connections.
• Ed25519 — cryptographic report signing.
• SHA-256 — content integrity verification in reports.
• API keys stored salted and hashed.

11. Regular Review

• Annual review of technical and organisational measures.
• Updates upon technical changes or new threat scenarios.
• Documentation of all changes to these measures.

---

Last updated: April 2026. Next scheduled review: April 2027.